SectionVulnerabilities
Patches, advisories and the CVEs behind them.
Railway Tells Users to Rotate Secrets After Possible Environment Variable Breach
Cloud hosting platform Railway says an unauthorized third party may have accessed and decrypted customer environment variables, part of a wider wave…
Quest Diagnostics Confirms Breach Exposed Patient Records via Lab Portal
The clinical lab giant says unauthorized access to its Quanum LSM ordering and results platform compromised patient data, prompting a shutdown of…
PHP Discloses Unpatched RCE Flaw, Offers Mitigation Pending Fix
PHP's security team detailed a new remote code execution vulnerability affecting an uncommon configuration, days after rushing out patches for the actively…
Ruby Patches Onigmo Regex Bugs Tied to Four Critical GitLab RCE Flaws
Ruby has shipped fixes for three memory corruption bugs in its Onigmo regex engine after GitLab traced four critical remote code execution…
Weak eMudhra CA Keys Let Anyone Forge Trusted TLS Certificates
Eight eMudhra intermediate CA certificates were found to use private keys so weak they could be recovered in seconds, prompting emergency revocations…
Zeabur to Shut Down After Second Breach in Two Months Exposes 321,810 Accounts
Hosting platform Zeabur is winding down operations by year's end after attackers used leaked plaintext credentials to steal 3.2 million environment-variable records,…
PHP Rushes Emergency Patches After Two Critical RCE Flaws Leak Early
Details of two critical remote code execution vulnerabilities affecting PHP versions 5 through 8 leaked ahead of schedule, pushing the PHP security…
Plex2Shell Exploit Chain Hits Servers Within a Day of Public PoC
Attackers are chaining four Plex Media Server flaws, tracked as Plex2Shell, to deploy XMRig cryptocurrency miners and a Linux proxy backdoor on…
October Windows Server Updates Break Exchange Sign-In and Mail Flow
Microsoft confirms this month's Windows Server security updates are causing OWA sign-in failures and stalled mail delivery on Exchange systems, and has…
Critical BlockStrap Flaw Could Let Hackers Run Code on Magento Servers
Researchers warn that CVE-2026-103849, a maximum-severity template injection bug in Adobe Commerce and Magento, could soon be weaponized despite Adobe's lower urgency…
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Land Fast
Drupal has fixed two critical remote code execution vulnerabilities affecting all supported core versions, urging administrators to patch quickly before attackers reverse-engineer…
Palo Alto Networks Patches Exploited PAN-OS Zero-Day, CISA Adds It to KEV
A high-severity PAN-OS management interface flaw, CVE-2026-0322, is being actively exploited to gain root code execution. Patches are out and federal agencies…